FOIAXpress CVE-2025-62586

No special conditions - remote unauthenticated exploitation against default configurations of OPEXUS FOIAXpress in all versions prior to 11.13.2.0. The only prerequisite is network reachability to the FOIAXpress web application's password-reset functionality; no credentials, user interaction, or non-default settings are required. The primary limiting factor is exposure: FOIAXpress is typically an internal/agency-hosted application, so internet-facing instances are at immediate risk while those restricted to internal or VPN-only networks reduce the attacker population. Remediation is to upgrade to version 11.13.2.0.

Multiple signals converge on a genuinely high-severity flaw: CWE-306 (missing authentication for a critical function) combined with the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:H/VI:H/VA:H) means a remote, unauthenticated attacker can reset the administrator password over the network with low complexity and no user interaction, yielding full administrative compromise. The source CVSS 4.0 vector also carries E:P (exploit maturity = Proof-of-Concept) and AU:Y (Automatable), and the vendor-assigned urgency is U:Red - all pointing to a serious, scriptable issue. However, the signals are not uniformly alarming: EPSS is only 0.72% (52nd percentile), there is NO CISA KEV listing, and no standalone public exploit reference is provided, so there is currently no evidence of active or widespread exploitation despite the critical technical impact. The low EPSS alongside a Red urgency and E:P maturity suggests a dangerous-but-not-yet-mass-exploited condition, consistent with a niche, government-focused product. Note the data tension: the CVSS 4.0 vector asserts Proof-of-Concept exploit maturity (E:P), but no POC URL is supplied in the references - verify POC availability independently before treating exploit code as confirmed. Net: a real priority for anyone running FOIAXpress below 11.13.2.0 given trivial exploitability and total impact, but the absence of KEV and low EPSS indicate it is not (yet) being exploited at scale.

An attacker who can reach the FOIAXpress web application over the network sends a request to the password-reset function without authenticating, resets the administrator account password to a value they control, and logs in with full admin privileges over the FOIA case-management system and its sensitive records. Given AV:N/AC:L/PR:N/UI:N and the CVSS threat metric marking exploit maturity as Proof-of-Concept (E:P), the attack is low-complexity and likely scriptable (AU:Y, Automatable). No user interaction or prior credentials are required.